uninstall.exe

虫虫的夏天

uninstall.exe

langzi2009

红伞kill

XE-cj

2010-8-17 22:09:32    创建新进程    允许
进程: c:\windows\explorer.exe
目标: c:\documents and settings\xe-cj\my documents\uninstall.exe
命令行: "C:\Documents and Settings\XE-CJ\My Documents\uninstall.exe"
规则: [应用程序]c:\windows\explorer.exe

2010-8-17 22:09:34    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\nsv5.tmp
规则: [文件]*

2010-8-17 22:09:35    创建文件夹    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~nsu.tmp
规则: [文件]*

2010-8-17 22:09:36    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~nsu.tmp\Au_.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-17 22:09:40    修改注册表值    阻止
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\~nsu.tmp\Au_.exe
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2010-8-17 22:09:41    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统关键文件 -> [文件]c:\windows; wininit.ini

2010-8-17 22:09:47    创建新进程    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\au_.exe
命令行: "C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\~nsu.tmp\Au_.exe"   _?=C:\Documents and Settings\XE-CJ\My Documents\
规则: [应用程序]*

2010-8-17 22:09:48    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\~nsu.tmp\Bu_.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-17 22:09:50    创建文件    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统关键文件 -> [文件]c:\windows; wininit.ini

2010-8-17 22:09:52    创建新进程    允许
进程: c:\documents and settings\xe-cj\my documents\uninstall.exe
目标: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
命令行: "C:\DOCUME~1\XE-CJ\LOCALS~1\Temp\~nsu.tmp\Bu_.exe"   _?=C:\Documents and Settings\XE-CJ\My Documents\
规则: [应用程序]*

2010-8-17 22:09:54    创建文件    允许
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\nsb6.tmp
规则: [文件]*

2010-8-17 22:09:55    创建文件    允许
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\nsu7.tmp
规则: [文件]*

2010-8-17 22:09:56    创建文件夹    允许
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\nsu7.tmp
规则: [文件]*

2010-8-17 22:09:58    创建文件    允许
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\Local Settings\Temp\nsu7.tmp\nsProcess.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

2010-8-17 22:10:00    删除文件    阻止
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\My Documents\desktop.ini
规则: [文件组]临时目录 -> [文件]c:\documents and settings\xe-cj\my documents

2010-8-17 22:10:04    修改注册表值    阻止
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
值: \??\C:\Documents and Settings\XE-CJ\My Documents\desktop.ini
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager; PendingFileRenameOperations

2010-8-17 22:10:06    创建文件    允许
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统关键文件 -> [文件]c:\windows; wininit.ini

2010-8-17 22:10:11    删除文件    阻止
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\My Documents\PowerToolV2.4\PowerTool.exe
规则: [文件组]所有执行文件 -> [文件]*; *.exe

2010-8-17 22:10:13    创建文件    允许
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\WINDOWS\wininit.ini
规则: [文件组]系统关键文件 -> [文件]c:\windows; wininit.ini

2010-8-17 22:10:18    删除文件    阻止并结束进程
进程: c:\documents and settings\xe-cj\local settings\temp\~nsu.tmp\bu_.exe
目标: C:\Documents and Settings\XE-CJ\My Documents\PowerToolV2.4\ShellExtend.dll
规则: [文件组]所有执行文件 -> [文件]*; *.dll

submit to avertlabs

蝉鸣时

To ESET, KL.

8073176430

to eset via e-mail

金山升级精灵

to Symantec

hansyu

panda miss
to xandora(panda)

BitDefender

毒霸 0个

taihuxian

安全